CVE-2021-42127

CRITICAL 9.8CVE-2021-42127 · Published 07/12/2021 · updated 17/06/2026

In short

CVE-2021-42127 is a CRITICAL (CVSS 9.8) vulnerability affecting avalanche (ivanti).
Chance of exploitation in the next 30 days (EPSS): 65.8%, higher than 99.3% of all vulnerabilities.
Fix: update to 6.3.3 or later.

Package	Affected versions	Patched versions
avalanche ivanti	`< 6.3.3`	`6.3.3`

Description

A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execution via Data Repository Service.

References

forums.ivanti.com/s/article/Security-Alert-CVE-s-Addressed-in-Avalanche-6-3-3 · Vendor Advisory

More vulnerabilities in avalanche

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

avalanche

ivanti

< 6.3.3

6.3.3

More vulnerabilities in avalanche

See all →